Merge ~alexmurray/ubuntu-cve-tracker:check-cves-hint-from-srcpkg-homepage-and-ref-urls into ubuntu-cve-tracker:master

[Alex Murray]

scripts/check-cves: try match CVE references against package homepages

Parse and store the Homepage field in source_map and then try and match these
URLs against any we see in the references for a CVE to hint that the package is
likely affected.

[Alex Murray (alexmurray)]

Not sure if the grep-aptavail shell command is a hack or whether we should try and integrate this into source_map and look it up from there - thoughts?

[Mark Esler (eslerm)]

This looks great. Cleans up a lot.

Could the homepages_map code be a function?

[Alex Murray (alexmurray)]

Reworked this to use source_map instead as suggested in the comment above.

[Alex Murray (alexmurray)]

Will require a re-run of ./scripts/gen-source-map-cache to populate the cache (or wait for the next packages-mirror run)

Unmerged commits

5c6cf4f... by Alex Murray on 2024-04-12

scripts/check-cves: try match CVE references against package homepages

Parse and store the Homepage field in source_map and then try and match these
URLs against any we see in the references for a CVE to hint that the package is
likely affected.

Signed-off-by: Alex Murray <email address hidden>

	unit-tests:0 (build)
	check-cves:0 (build)

1 → 2 of 2 results

First • Previous • Next • Last

diff --git a/scripts/check-cves b/scripts/check-cves
index be0b713..301b3ef 100755
--- a/scripts/check-cves
+++ b/scripts/check-cves
@@ -83,6 +83,17 @@ common_words = ['an', 'and', 'context', 'file', 'modules', 'the', 'when']
 allsrcs.difference_update(set(common_words))
 allsrcs.update(set(cve_lib.package_db.keys()))
 
+# build list of known homepages for source packages
+homepages_map = {}
+for release in list(source.keys()):
+    for src in source[release]:
+        try:
+            homepage = source[release][src]['homepage']
+            homepages_map.setdefault(src, set())
+            homepages_map[src].add(homepage)
+        except KeyError:
+            pass
+
 built_using_map = None
 
 destdir = "."
@@ -949,7 +960,6 @@ class CVEHandler(xml.sax.handler.ContentHandler):
             action = 'unembargo'
             reason = ""
         else:
-            words = self.get_software_hints_from_cve_description(self.cve_data[cve]['desc'])
             # Default to Debian state, if available
             if self.debian and cve in self.debian and self.debian[cve]['state']:
                 if self.debian[cve]['state'].startswith('NOT-FOR-US:'):
@@ -968,7 +978,20 @@ class CVEHandler(xml.sax.handler.ContentHandler):
                     action = 'ignore'
                     reason = 'REJECTED'
             # try based on description
+            words = self.get_software_hints_from_cve_description(self.cve_data[cve]['desc'])
             if action == 'skip':
+                # try and hint if any of the references use a URL that is within
+                # a known packages Homepage from homepages_map
+                if 'refs' in self.cve_data[cve]:
+                    for ref in self.cve_data[cve]['refs']:
+                        url = ref[2]
+                        for srcpkg in homepages_map:
+                            for homepage in homepages_map[srcpkg]:
+                                # TODO: do smarter matching than this
+                                if homepage in url:
+                                    print(f"Detected {srcpkg} homepage in reference URL: {url}")
+                                    action = 'add'
+                                    packages.append(srcpkg)
                 # try and hint if the detected product name contains any known
                 # package names - this list also contains aliases and so we want
                 # to transform the aliases back into their known package name
diff --git a/scripts/source_map.py b/scripts/source_map.py
index bb5dde3..293281b 100755
--- a/scripts/source_map.py
+++ b/scripts/source_map.py
@@ -269,6 +269,8 @@ def load_sources_collection(item, map, detailed=True):
         if detailed:
             if 'Description' in parser.section:
                 map[release][pkg]['description'] = parser.section['Description']
+            if 'Homepage' in parser.section:
+                map[release][pkg]['homepage'] = parser.section['Homepage']
             if not pocket:
                 map[release][pkg]['release_version'] = parser.section['Version']
             if apt_pkg.version_compare(parser.section['Version'], map[release][pkg]['version']) > 0:
@@ -288,6 +290,8 @@ def load_packages_collection(item, map):
         map[release][pkg]['section'] = section
         if 'Description' in parser.section:
             map[release][pkg]['description'] = parser.section['Description']
+        if 'Homepage' in parser.section:
+            map[release][pkg]['homepage'] = parser.section['Homepage']
 
         if not pocket:
             map[release][pkg]['release_version'] = parser.section['Version']